From d03008dfaaa1a9dc7eb92ce6554602ffc9103bb1 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Thu, 12 Nov 2026 16:31:40 +0000
Subject: [PATCH 1/2] Fail Vercel builds when native OAuth configuration is
 invalid

---
 package.json                         |  3 ++-
 scripts/check-native-oauth-config.ts | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 scripts/check-native-oauth-config.ts

diff --git a/package.json b/package.json
index 26dd2793..08df7ad7 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,8 @@
     "dev": "next dev -p 3002",
     "build:managed-auth-app": "bun scripts/build-managed-auth-app.mjs",
     "check:managed-auth-app": "bun scripts/build-managed-auth-app.mjs --check",
-    "build": "bun run check:managed-auth-app && next build",
+    "check:native-oauth-config": "bun scripts/check-native-oauth-config.ts",
+    "build": "bun run check:managed-auth-app && bun run check:native-oauth-config && next build",
     "start": "next start -p 3002",
     "lint": "next lint",
     "test": "bun test",
diff --git a/scripts/check-native-oauth-config.ts b/scripts/check-native-oauth-config.ts
new file mode 100644
index 00000000..c41b9a3a
--- /dev/null
+++ b/scripts/check-native-oauth-config.ts
@@ -0,0 +1,20 @@
+// Runs the server's native OAuth startup check during Vercel builds, so a
+// misconfigured environment fails its deployment and the previous one keeps
+// serving. Local builds skip it; the dev server runs the same check at startup.
+import { nativeOAuthConfig } from "@/lib/native-oauth";
+
+if (!process.env.VERCEL) process.exit(0);
+
+try {
+  const config = nativeOAuthConfig();
+  console.info(
+    config
+      ? `native OAuth configuration ok: issuer ${config.issuer}, resource ${config.audience}`
+      : "native OAuth disabled for this deployment",
+  );
+} catch (error) {
+  console.error(
+    `native OAuth configuration is invalid: ${error instanceof Error ? error.message : String(error)}`,
+  );
+  process.exit(1);
+}

From d3835028d380931bf56902cd351804b8faf5998f Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Thu, 12 Nov 2026 18:28:17 +0000
Subject: [PATCH 2/2] Load native OAuth config only on Vercel and share its log
 line with startup

---
 scripts/check-native-oauth-config.ts | 19 ++++---------------
 src/instrumentation.ts               |  9 ++-------
 src/lib/native-oauth.ts              |  8 ++++++++
 3 files changed, 14 insertions(+), 22 deletions(-)

diff --git a/scripts/check-native-oauth-config.ts b/scripts/check-native-oauth-config.ts
index c41b9a3a..042406be 100644
--- a/scripts/check-native-oauth-config.ts
+++ b/scripts/check-native-oauth-config.ts
@@ -1,20 +1,9 @@
 // Runs the server's native OAuth startup check during Vercel builds, so a
 // misconfigured environment fails its deployment and the previous one keeps
 // serving. Local builds skip it; the dev server runs the same check at startup.
-import { nativeOAuthConfig } from "@/lib/native-oauth";
+export {};
 
-if (!process.env.VERCEL) process.exit(0);
-
-try {
-  const config = nativeOAuthConfig();
-  console.info(
-    config
-      ? `native OAuth configuration ok: issuer ${config.issuer}, resource ${config.audience}`
-      : "native OAuth disabled for this deployment",
-  );
-} catch (error) {
-  console.error(
-    `native OAuth configuration is invalid: ${error instanceof Error ? error.message : String(error)}`,
-  );
-  process.exit(1);
+if (process.env.VERCEL) {
+  const { describeNativeOAuthConfig } = await import("@/lib/native-oauth");
+  console.info(describeNativeOAuthConfig());
 }
diff --git a/src/instrumentation.ts b/src/instrumentation.ts
index f9e00955..5c75fe2e 100644
--- a/src/instrumentation.ts
+++ b/src/instrumentation.ts
@@ -3,11 +3,6 @@
 // native OAuth settings stop a deployment instead of failing per request.
 export async function register() {
   if (process.env.NEXT_RUNTIME !== "nodejs") return;
-  const { nativeOAuthConfig } = await import("@/lib/native-oauth");
-  const config = nativeOAuthConfig();
-  console.info(
-    config
-      ? `native OAuth enabled: issuer ${config.issuer}, resource ${config.audience}`
-      : "native OAuth disabled",
-  );
+  const { describeNativeOAuthConfig } = await import("@/lib/native-oauth");
+  console.info(describeNativeOAuthConfig());
 }
diff --git a/src/lib/native-oauth.ts b/src/lib/native-oauth.ts
index b93f7354..ad6d2ee3 100644
--- a/src/lib/native-oauth.ts
+++ b/src/lib/native-oauth.ts
@@ -194,6 +194,14 @@ export function nativeOAuthConfig(): NativeOAuthConfig | null {
   return resolvedConfig.value;
 }
 
+// One line for startup and build logs. Throws when the configuration is invalid.
+export function describeNativeOAuthConfig(): string {
+  const config = nativeOAuthConfig();
+  return config
+    ? `native OAuth enabled: issuer ${config.issuer}, resource ${config.audience}`
+    : "native OAuth disabled";
+}
+
 const keySets = new Map<string, JWTVerifyGetKey>();
 
 // Keys come only from the configured issuer's JWKS, never from a URL in the